Skip to content

Commit c9122a5

Browse files
zjjhotzjjhot
committed
Merge remote-tracking branch 'giteaofficial/main'
* giteaofficial/main: Use `CryptoRandomBytes` instead of `CryptoRandomString` (go-gitea#18439) Remove the spurious space in the .ui.right additional selector (go-gitea#18605) Ensure commit-statuses box is sized correctly in headers (go-gitea#18538) [skip ci] Updated translations via Crowdin Prevent merge messages from being sorted to the top of email chains (go-gitea#18566) Fix pushing to 1-x-dev docker tag (go-gitea#18578) Replace `sync.Map` with normal maps (go-gitea#18584) Fix oauth docs usage for 2fa (go-gitea#18581) Update .gitattributes for .tmpl files (go-gitea#18576) Prevent panic on prohibited user login with oauth2 (go-gitea#18562) Fix manifest.tmpl (go-gitea#18573) Make docker gitea/gitea:v1.16-dev etc refer to the latest build on that branch (go-gitea#18551) Add dropdown icon to template loading dropdown (go-gitea#18564)
2 parents 8503c0b + aa23f47 commit c9122a5

File tree

18 files changed

+326
-89
lines changed

18 files changed

+326
-89
lines changed

‎.drone.yml

+128
Original file line numberDiff line numberDiff line change
@@ -854,6 +854,67 @@ steps:
854854
exclude:
855855
- pull_request
856856

857+
---
858+
kind: pipeline
859+
name: docker-linux-amd64-release-branch
860+
861+
platform:
862+
os: linux
863+
arch: amd64
864+
865+
depends_on:
866+
- testing-amd64
867+
- testing-arm64
868+
869+
trigger:
870+
ref:
871+
- "refs/heads/release/v*"
872+
event:
873+
exclude:
874+
- cron
875+
876+
steps:
877+
- name: fetch-tags
878+
image: docker:git
879+
commands:
880+
- git fetch --tags --force
881+
882+
- name: publish
883+
pull: always
884+
image: techknowlogick/drone-docker:latest
885+
settings:
886+
auto_tag: false
887+
tags: ${DRONE_BRANCH##release/v}-dev-linux-amd64
888+
repo: gitea/gitea
889+
build_args:
890+
- GOPROXY=https://goproxy.cn
891+
password:
892+
from_secret: docker_password
893+
username:
894+
from_secret: docker_username
895+
when:
896+
event:
897+
exclude:
898+
- pull_request
899+
900+
- name: publish-rootless
901+
image: techknowlogick/drone-docker:latest
902+
settings:
903+
dockerfile: Dockerfile.rootless
904+
auto_tag: false
905+
tags: ${DRONE_BRANCH##release/v}-dev-linux-amd64-rootless
906+
repo: gitea/gitea
907+
build_args:
908+
- GOPROXY=https://goproxy.cn
909+
password:
910+
from_secret: docker_password
911+
username:
912+
from_secret: docker_username
913+
when:
914+
event:
915+
exclude:
916+
- pull_request
917+
857918
---
858919
kind: pipeline
859920
type: docker
@@ -1010,6 +1071,68 @@ steps:
10101071
event:
10111072
exclude:
10121073
- pull_request
1074+
1075+
---
1076+
kind: pipeline
1077+
name: docker-linux-arm64-release-branch
1078+
1079+
platform:
1080+
os: linux
1081+
arch: arm64
1082+
1083+
depends_on:
1084+
- testing-amd64
1085+
- testing-arm64
1086+
1087+
trigger:
1088+
ref:
1089+
- "refs/heads/release/v*"
1090+
event:
1091+
exclude:
1092+
- cron
1093+
1094+
steps:
1095+
- name: fetch-tags
1096+
image: docker:git
1097+
commands:
1098+
- git fetch --tags --force
1099+
1100+
- name: publish
1101+
pull: always
1102+
image: techknowlogick/drone-docker:latest
1103+
settings:
1104+
auto_tag: false
1105+
tags: ${DRONE_BRANCH##release/v}-dev-linux-arm64
1106+
repo: gitea/gitea
1107+
build_args:
1108+
- GOPROXY=https://goproxy.cn
1109+
password:
1110+
from_secret: docker_password
1111+
username:
1112+
from_secret: docker_username
1113+
when:
1114+
event:
1115+
exclude:
1116+
- pull_request
1117+
1118+
- name: publish-rootless
1119+
image: techknowlogick/drone-docker:latest
1120+
settings:
1121+
dockerfile: Dockerfile.rootless
1122+
auto_tag: false
1123+
tags: ${DRONE_BRANCH##release/v}-dev-linux-arm64-rootless
1124+
repo: gitea/gitea
1125+
build_args:
1126+
- GOPROXY=https://goproxy.cn
1127+
password:
1128+
from_secret: docker_password
1129+
username:
1130+
from_secret: docker_username
1131+
when:
1132+
event:
1133+
exclude:
1134+
- pull_request
1135+
10131136
---
10141137
kind: pipeline
10151138
type: docker
@@ -1090,13 +1213,16 @@ steps:
10901213
trigger:
10911214
ref:
10921215
- refs/heads/main
1216+
- "refs/heads/release/v*"
10931217
event:
10941218
exclude:
10951219
- cron
10961220

10971221
depends_on:
10981222
- docker-linux-amd64-release
10991223
- docker-linux-arm64-release
1224+
- docker-linux-amd64-release-branch
1225+
- docker-linux-arm64-release-branch
11001226

11011227
---
11021228
kind: pipeline
@@ -1130,6 +1256,8 @@ depends_on:
11301256
- docker-linux-arm64-release
11311257
- docker-linux-amd64-release-version
11321258
- docker-linux-arm64-release-version
1259+
- docker-linux-amd64-release-branch
1260+
- docker-linux-arm64-release-branch
11331261
- docker-manifest
11341262
- docker-manifest-version
11351263
- docs

‎.gitattributes

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
* text=auto eol=lf
2-
/vendor/** -text -eol linguist-vendored
3-
/public/vendor/** -text -eol linguist-vendored
4-
/web_src/js/vendor/** -text -eol linguist-vendored
5-
/templates/**/*.tmpl linguist-language=Handlebars
2+
*.tmpl linguist-language=Handlebars
63
/.eslintrc linguist-language=YAML
74
/.stylelintrc linguist-language=YAML
5+
/public/vendor/** -text -eol linguist-vendored
6+
/vendor/** -text -eol linguist-vendored
87
/web_src/fomantic/build/** linguist-generated
8+
/web_src/js/vendor/** -text -eol linguist-vendored
99
Dockerfile.* linguist-language=Dockerfile

‎docker/manifest.rootless.tmpl

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}dev{{/if}}-rootless
1+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}{{#if (hasPrefix "refs/heads/release/v" build.ref)}}{{trimPrefix "refs/heads/release/v" build.ref}}-{{/if}}dev{{/if}}-rootless
22
{{#if build.tags}}
33
tags:
44
{{#each build.tags}}
@@ -8,12 +8,12 @@ tags:
88
{{/if}}
99
manifests:
1010
-
11-
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}dev{{/if}}-linux-amd64-rootless
11+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}{{#if (hasPrefix "refs/heads/release/v" build.ref)}}{{trimPrefix "refs/heads/release/v" build.ref}}-{{/if}}dev{{/if}}-linux-amd64-rootless
1212
platform:
1313
architecture: amd64
1414
os: linux
1515
-
16-
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}dev{{/if}}-linux-arm64-rootless
16+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}{{#if (hasPrefix "refs/heads/release/v" build.ref)}}{{trimPrefix "refs/heads/release/v" build.ref}}-{{/if}}dev{{/if}}-linux-arm64-rootless
1717
platform:
1818
architecture: arm64
1919
os: linux

‎docker/manifest.tmpl

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}dev{{/if}}
1+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}{{#if (hasPrefix "refs/heads/release/v" build.ref)}}{{trimPrefix "refs/heads/release/v" build.ref}}-{{/if}}dev{{/if}}
22
{{#if build.tags}}
33
tags:
44
{{#each build.tags}}
@@ -8,13 +8,13 @@ tags:
88
{{/if}}
99
manifests:
1010
-
11-
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{else}}dev-{{/if}}linux-amd64
11+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}{{#if (hasPrefix "refs/heads/release/v" build.ref)}}{{trimPrefix "refs/heads/release/v" build.ref}}-{{/if}}dev{{/if}}-linux-amd64
1212
platform:
1313
architecture: amd64
1414
os: linux
1515
-
16-
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{else}}dev-{{/if}}linux-arm64
16+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}{{#if (hasPrefix "refs/heads/release/v" build.ref)}}{{trimPrefix "refs/heads/release/v" build.ref}}-{{/if}}dev{{/if}}-linux-arm64
1717
platform:
1818
architecture: arm64
1919
os: linux
20-
variant: v8
20+
variant: v8

‎docs/content/doc/installation/with-docker-rootless.en-us.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ image as a service. Since there is no database available, one can be initialized
3232
Create a directory for `data` and `config` then paste the following content into a file named `docker-compose.yml`.
3333
Note that the volume should be owned by the user/group with the UID/GID specified in the config file. By default Gitea in docker will use uid:1000 gid:1000. If needed you can set ownership on those folders with the command: `sudo chown 1000:1000 config/ data/`
3434
If you don't give the volume correct permissions, the container may not start.
35-
For a stable release you could use `:latest-rootless`, `:1-rootless` or specify a certain release like `:{{< version >}}-rootless`, but if you'd like to use the latest development version then `:dev-rootless` would be an appropriate tag.
35+
For a stable release you could use `:latest-rootless`, `:1-rootless` or specify a certain release like `:{{< version >}}-rootless`, but if you'd like to use the latest development version then `:dev-rootless` would be an appropriate tag. If you'd like to run the latest commit from a release branch you can use the `:1.x-dev-rootless` tag, where x is the minor version of Gitea. (e.g. `:1.16-dev-rootless`)
3636

3737
```yaml
3838
version: "2"

‎docs/content/doc/installation/with-docker.en-us.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ image as a service. Since there is no database available, one can be initialized
3434
Create a directory like `gitea` and paste the following content into a file named `docker-compose.yml`.
3535
Note that the volume should be owned by the user/group with the UID/GID specified in the config file.
3636
If you don't give the volume correct permissions, the container may not start.
37-
For a stable release you can use `:latest`, `:1` or specify a certain release like `:{{< version >}}`, but if you'd like to use the latest development version of Gitea then you could use the `:dev` tag.
37+
For a stable release you can use `:latest`, `:1` or specify a certain release like `:{{< version >}}`, but if you'd like to use the latest development version of Gitea then you could use the `:dev` tag. If you'd like to run the latest commit from a release branch you can use the `:1.x-dev` tag, where x is the minor version of Gitea. (e.g. `:1.16-dev`)
3838

3939
```yaml
4040
version: "3"

‎docs/content/doc/usage/command-line.en-us.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ Admin operations:
129129
- `--custom-profile-url`: Use a custom Profile URL (option for GitLab/GitHub).
130130
- `--custom-email-url`: Use a custom Email URL (option for GitHub).
131131
- `--icon-url`: Custom icon URL for OAuth2 login source.
132-
- `--override-local-2fa`: Allow source to override local 2FA. (Optional)
132+
- `--skip-local-2fa`: Allow source to override local 2FA. (Optional)
133133
- `--scopes`: Additional scopes to request for this OAuth2 source. (Optional)
134134
- `--required-claim-name`: Claim name that has to be set to allow users to login with this source. (Optional)
135135
- `--required-claim-value`: Claim value that has to be set to allow users to login with this source. (Optional)
@@ -152,7 +152,7 @@ Admin operations:
152152
- `--custom-profile-url`: Use a custom Profile URL (option for GitLab/GitHub).
153153
- `--custom-email-url`: Use a custom Email URL (option for GitHub).
154154
- `--icon-url`: Custom icon URL for OAuth2 login source.
155-
- `--override-local-2fa`: Allow source to override local 2FA. (Optional)
155+
- `--skip-local-2fa`: Allow source to override local 2FA. (Optional)
156156
- `--scopes`: Additional scopes to request for this OAuth2 source.
157157
- `--required-claim-name`: Claim name that has to be set to allow users to login with this source. (Optional)
158158
- `--required-claim-value`: Claim value that has to be set to allow users to login with this source. (Optional)

‎integrations/api_oauth2_apps_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func testAPICreateOAuth2Application(t *testing.T) {
4343
DecodeJSON(t, resp, &createdApp)
4444

4545
assert.EqualValues(t, appBody.Name, createdApp.Name)
46-
assert.Len(t, createdApp.ClientSecret, 44)
46+
assert.Len(t, createdApp.ClientSecret, 56)
4747
assert.Len(t, createdApp.ClientID, 36)
4848
assert.NotEmpty(t, createdApp.Created)
4949
assert.EqualValues(t, appBody.RedirectURIs[0], createdApp.RedirectURIs[0])

‎models/auth/oauth2.go

+18-4
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ package auth
66

77
import (
88
"crypto/sha256"
9+
"encoding/base32"
910
"encoding/base64"
1011
"fmt"
1112
"net/url"
1213
"strings"
1314

1415
"code.gitea.io/gitea/models/db"
15-
"code.gitea.io/gitea/modules/secret"
1616
"code.gitea.io/gitea/modules/timeutil"
1717
"code.gitea.io/gitea/modules/util"
1818

@@ -57,12 +57,22 @@ func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {
5757
return util.IsStringInSlice(redirectURI, app.RedirectURIs, true)
5858
}
5959

60+
// Base32 characters, but lowercased.
61+
const lowerBase32Chars = "abcdefghijklmnopqrstuvwxyz234567"
62+
63+
// base32 encoder that uses lowered characters without padding.
64+
var base32Lower = base32.NewEncoding(lowerBase32Chars).WithPadding(base32.NoPadding)
65+
6066
// GenerateClientSecret will generate the client secret and returns the plaintext and saves the hash at the database
6167
func (app *OAuth2Application) GenerateClientSecret() (string, error) {
62-
clientSecret, err := secret.New()
68+
rBytes, err := util.CryptoRandomBytes(32)
6369
if err != nil {
6470
return "", err
6571
}
72+
// Add a prefix to the base32, this is in order to make it easier
73+
// for code scanners to grab sensitive tokens.
74+
clientSecret := "gto_" + base32Lower.EncodeToString(rBytes)
75+
6676
hashedSecret, err := bcrypt.GenerateFromPassword([]byte(clientSecret), bcrypt.DefaultCost)
6777
if err != nil {
6878
return "", err
@@ -394,10 +404,14 @@ func (grant *OAuth2Grant) GenerateNewAuthorizationCode(redirectURI, codeChalleng
394404
}
395405

396406
func (grant *OAuth2Grant) generateNewAuthorizationCode(e db.Engine, redirectURI, codeChallenge, codeChallengeMethod string) (code *OAuth2AuthorizationCode, err error) {
397-
var codeSecret string
398-
if codeSecret, err = secret.New(); err != nil {
407+
rBytes, err := util.CryptoRandomBytes(32)
408+
if err != nil {
399409
return &OAuth2AuthorizationCode{}, err
400410
}
411+
// Add a prefix to the base32, this is in order to make it easier
412+
// for code scanners to grab sensitive tokens.
413+
codeSecret := "gta_" + base32Lower.EncodeToString(rBytes)
414+
401415
code = &OAuth2AuthorizationCode{
402416
Grant: grant,
403417
GrantID: grant.ID,

‎modules/secret/secret.go

-12
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,8 @@ import (
1313
"encoding/hex"
1414
"errors"
1515
"io"
16-
17-
"code.gitea.io/gitea/modules/util"
1816
)
1917

20-
// New creates a new secret
21-
func New() (string, error) {
22-
return NewWithLength(44)
23-
}
24-
25-
// NewWithLength creates a new secret for a given length
26-
func NewWithLength(length int64) (string, error) {
27-
return util.CryptoRandomString(length)
28-
}
29-
3018
// AesEncrypt encrypts text and given key with AES.
3119
func AesEncrypt(key, text []byte) ([]byte, error) {
3220
block, err := aes.NewCipher(key)

‎modules/secret/secret_test.go

-11
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,6 @@ import (
1010
"github.com/stretchr/testify/assert"
1111
)
1212

13-
func TestNew(t *testing.T) {
14-
result, err := New()
15-
assert.NoError(t, err)
16-
assert.True(t, len(result) == 44)
17-
18-
result2, err := New()
19-
assert.NoError(t, err)
20-
// check if secrets
21-
assert.NotEqual(t, result, result2)
22-
}
23-
2413
func TestEncryptDecrypt(t *testing.T) {
2514
var hex string
2615
var str string

‎options/locale/locale_ja-JP.ini

+4
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,7 @@ search=検索
268268
code=コード
269269
search.fuzzy=あいまい
270270
search.match=一致
271+
code_search_unavailable=現在コード検索は利用できません。 サイト管理者にお問い合わせください。
271272
repo_no_results=一致するリポジトリが見つかりません。
272273
user_no_results=一致するユーザーが見つかりません。
273274
org_no_results=一致する組織が見つかりません。
@@ -1262,6 +1263,7 @@ issues.filter_sort.moststars=スターが多い順
12621263
issues.filter_sort.feweststars=スターが少ない順
12631264
issues.filter_sort.mostforks=フォークが多い順
12641265
issues.filter_sort.fewestforks=フォークが少ない順
1266+
issues.keyword_search_unavailable=現在キーワード検索は利用できません。 サイト管理者にお問い合わせください。
12651267
issues.action_open=オープン
12661268
issues.action_close=クローズ
12671269
issues.action_label=ラベル
@@ -1707,6 +1709,8 @@ search.search_repo=リポジトリを検索
17071709
search.fuzzy=あいまい
17081710
search.match=一致
17091711
search.results=<a href="%[2]s">%[3]s</a> 内での "%[1]s" の検索結果
1712+
search.code_no_results=検索ワードに一致するソースコードが見つかりません。
1713+
search.code_search_unavailable=現在コード検索は利用できません。 サイト管理者にお問い合わせください。
17101714

17111715
settings=設定
17121716
settings.desc=設定では、リポジトリの設定を管理することができます。

‎routers/web/auth/oauth.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -822,7 +822,7 @@ func SignInOAuthCallback(ctx *context.Context) {
822822
u, gothUser, err := oAuth2UserLoginCallback(authSource, ctx.Req, ctx.Resp)
823823
if err != nil {
824824
if user_model.IsErrUserProhibitLogin(err) {
825-
uplerr := err.(*user_model.ErrUserProhibitLogin)
825+
uplerr := err.(user_model.ErrUserProhibitLogin)
826826
log.Info("Failed authentication attempt for %s from %s: %v", uplerr.Name, ctx.RemoteAddr(), err)
827827
ctx.Data["Title"] = ctx.Tr("auth.prohibit_login")
828828
ctx.HTML(http.StatusOK, "user/auth/prohibit_login")

0 commit comments

Comments
 (0)